This blog article is based on the script provided at:
https://raw.githubusercontent.com/Nyr/openvpn-install/master/openvpn-install.sh
This script has been slightly modified for certain reasons mentioned below:
- The above script uses pre-defined dh.pem (My version generates a new random 2048 bit dh params)
- The above script generates client cert without password (My version mandates password and allows specifying the passwords in a separate file)
- The above script generates certificates with 10 years validity (My version generates certificates with 1 day validity i.e because I plan to re-generate certificates often, hmmmm, more like One time use certificates like OTP’s)
I have mentioned in a previous blog post – https://www.alightservices.com/2023/08/03/a-method-for-randomizing-vpn-security-for-cloud-based-workloads-alight-technology-and-services-limited/
I am looking for ways to randomize server-side cert, client ovpn, etc…
This script is part of the effort.
The script is attached here. Later a separate GitHub repo with some demo code would be provided. Then this blog post would be updated.
https://www.alightservices.com/wp-content/uploads/2023/08/openvpn-install.sh_.zip
Download the zip file, unzip, change the extension i.e remove .txt.
Provide execute permissions and execute the script.
> wget https://www.alightservices.com/wp-content/uploads/2023/08/openvpn-install.sh_.zip
> unzip openvpn-install.sh_.zip
> mv openvpn-install.sh.txt openvpn-install.sh
> sudo chmod +x openvpn-install.sh
> echo 'password
password' > infile
> cp infile outfile
> ./openvpn-install.shIn the above snippets, infile and outfile contains the same password two times on two different lines. Replace the password with what’s necessary or use some tools or utilities for generating password and writing into infile and outfile.
Now the C# part:
Using C# code, it’s very easy to generate random passwords and writing the passwords to infile, outfile.
System.Diagnostics.Process class allows executing shell scripts on Linux. Let’s look at some code sample:
Process process = new();
process.StartInfo.WorkingDirectory = "/path";
process.StartInfo.FileName = "/path/openvpn-install.sh";
process.StartInfo.Arguments = "";
process.EnableRaisingEvents = true;
process.Exited += Process_Exited;
process.ErrorDataReceived += Process_ErrorDataReceived;
process.OutputDataReceived += Process_OutputDataReceived;
process.StartInfo.RedirectStandardInput = true;
process.Start();
.
.
.
process.WaitForExit();
void Process_ErrorDataReceived(object sender, DataReceivedEventArgs e)
{
// Do whatever is necessary with e.Data;
}
void Process_OutputDataReceived(object sender, DataReceivedEventArgs e)
{
// Do whatever is necessary with e.Data;
}
void Process_Exited(object? sender, EventArgs e)
{
// Handle code if necessary
}In the above code snippet, we are executing a shell script located inside /path directory.
Because we are re-directing StandardInput by setting RedirectStandardInput = true, we can enter different values programatically on a necessary basis.
Or in the above shell script, the interactive prompts can be removed and pre-defined values can be used.
Using the above mentioned script, C# code snippets and by having passwords inside file, it becomes very easy to generate new server and client certificates and re-genrate certificates.
BTW the above mentioned script generates /etc/openvpn/server/server.conf, the following code server-config snippets might be of use, if needed add manually or update the script.
max-clients n
log /var/log/openvpn/openvpn.log
status /var/log/openvpn/status.txtmax-clients limits the maximum number of simultaneous connections.
log – writes log file, the verbosity can be controlled using verb. verb value of 9 means very verbose.
status – a little text file having information about current clients connections.
–
Mr. Kanti Kalyan Arumilli
B.Tech, M.B.A
Founder & CEO, Lead Full-Stack .Net developer
ALight Technology And Services Limited
Phone / SMS / WhatsApp on the following 3 numbers:
+91-789-362-6688, +1-480-347-6849, +44-07718-273-964
+44-33-3303-1284 (Preferred number if calling from U.K, No WhatsApp)
kantikalyan@gmail.com, kantikalyan@outlook.com, admin@alightservices.com, kantikalyan.arumilli@alightservices.com, KArumilli2020@student.hult.edu, KantiKArumilli@outlook.com and 3 more rarely used email addresses – hardly once or twice a year.
